CVE-2026-71849 Hono: Proxy Helper does not remove response headers listed in the `Connection` header

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header...

CVE-2026-71849

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header...

EUVD-2026-54578

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.0 to 4.12.33, the languageDetector middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen separated subtags. To...

EUVD-2026-51396

CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure...

Use of Less Trusted Source

Overview codeigniter4/framework is a PHP full-stack web framework that is light, fast, flexible, and secure. Affected versions of this package are vulnerable to Use of Less Trusted Source via the IncomingRequest::isSecure function. An attacker can cause the application to incorrectly treat insecu...

MAL-2026-13626 Malicious code in @mrbenty8jf1p9y5/oidc-bind-canary (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a9ed4acf296e53ad5955f759a0f0692d641781b1bd4e67ada1c116216f96fc3 The package's postinstall lifecycle script issues an HTTPS request from the installer's machine to a Cloudflare tunnel at...

CVE-2026-66062

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling for headers such as Accept uses a regular expression vulnerable to quadratic backtracking, so a maliciously...

SUSE CVE-2026-71554

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request...

SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header

Impact SvelteKit is vulnerable to remote CPU-exhaustion DoS attacks via specifically-crafted Accept headers. The impact is mitigated by default header length limits on most platforms, but in the case of raised or absent limits a denial of service is possible. Patches The vulnerability is patched ...

Regular Expression Denial of Service (ReDoS)

Overview @sveltejs/kit is a SvelteKit framework and CLI Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS through the Accept header processing. An attacker can exhaust CPU resources by sending specially crafted Accept headers, potentially leading to...

GHSA-29G2-3RMR-QM68 SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header

Impact SvelteKit is vulnerable to remote CPU-exhaustion DoS attacks via specifically-crafted Accept headers. The impact is mitigated by default header length limits on most platforms, but in the case of raised or absent limits a denial of service is possible. Patches The vulnerability is patched ...

CVE-2026-66062

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling for headers such as Accept uses a regular expression vulnerable to quadratic backtracking, so a maliciously...

EUVD-2026-54557

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling for headers such as Accept uses a regular expression vulnerable to quadratic backtracking, so a maliciously...

CVE-2026-66062 SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling for headers such as Accept uses a regular expression vulnerable to quadratic backtracking, so a maliciously...

CVE-2026-66062 SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling for headers such as Accept uses a regular expression vulnerable to quadratic backtracking, so a maliciously...

CVE-2026-66062 SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling for headers such as Accept uses a regular expression vulnerable to quadratic backtracking, so a maliciously...

poc-h2-duplicate-host

PoC: h2 Duplicate Host Header Request Smuggling Prim...

JLSEC-2026-1175 FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF...

FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a coresize value larger than the actual packet length. Attackers can exploit the missing bound...

CVE-2026-16637 OPeNDAP Hyrax SSRF and Credential Disclosure via Unvalidated Redirects

OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers User-Id, Echo-Token to attacker-controlled endpoints...

EUVD-2026-54479

OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers User-Id, Echo-Token to attacker-controlled endpoints...